I have a windows 2016 server with active directory that is also domain controller and apparently NTLM authentication is disabled. How I can enable NTLM authentication?


NT LAN Manager (including LM, NTLM v1, v2, and NTLM2) is enabled and active in Server 2016 by default, as its still used for local logon (on non-domain controllers) and workgroup logon authentication in Server 2016.

You can restrict and/or disable NTLM authentication via Group Policy. It's located in Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options, and the options are listed as "Network Security: Restrict NTLM:". There are seven options that are fairly self-explanatory.

I strongly recommend against relying on NTLM security, as even NTLM2 is weak and relatively easy to crack. If possible, it should be disabled on servers in modern Active Directory environments.

More Details: https://docs.microsoft.com/en-us/windows-server/security/kerberos/ntlm-overview

  • I can't find it in that path – SnowStorm Feb 7 at 4:58
  • What functional level is your domain? – Alex Feb 11 at 20:41
  • Windows Server 2016 – SnowStorm Feb 12 at 7:04
  • Are you using Group Policy Management or are you using secpol? Here is a screenshot of the settings: rootusers.com/wp-content/uploads/2017/03/… – Alex Feb 13 at 19:33
  • I'm using Group Policy Management and my settings is same as your screen shot – SnowStorm Feb 14 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.